Re: [Ksummit-discuss] [TECH TOPIC] Firmware signing

[David Woodhouse <dwmw2@infradead.org>]

[-- Attachment #1: Type: text/plain, Size: 5635 bytes --]

On Fri, 2015-07-31 at 09:14 -0700, Tim Bird wrote:
> On 07/31/2015 07:41 AM, Theodore Ts'o wrote:
> > I will note that this thread is a great demonstration why I very
> > *firmly* believe that legal issues (whether it is about license
> > interpretation or enforcement) should be completely out of scope 
> > for the kernel summit.

To a certain extent, I agree. You'll note my argument with James and
Greg was basically saying "you cannot make blanket statements like
that", rather than arguing that any particular interpretation was
"correct".

But there *is* a merit in a having a report from those who are actually
involved in compliance and enforcement "on the ground". Even if some
details of specific ongoing cases cannot be fully disclosed, there is a
lot of FUD and politicking around even what these entities are doing in
the *general* case and how they approach matters. It would be good to
have a proper discussion of the *facts* around that.

Even setting aside the question of "absolute truth", it is interesting
to note James's and Greg's opinions. I think a number of individual
contributors may also be very interested to hear a clear statement of
the LF's position on such matters — again in terms of the advice they
actually give in real cases, rather than pontification and speculation.

A number of people do currently seem to be a little concerned that the
LF might *not* be entirely representing their desires and their best
interests, so it would be good to have some clarity there.

> I agree with the sentiment.  But I do think kernel developers can 
> have some role in expressing the will and intention of the copyright
> holders

Agreed.

> (to the degree that's possible on a massively distributed project
> like the kernel).  As a hypothetical, if we wanted to create a safe
> haven for people to distribute binary firmware blobs linked to the
> kernel,

To be honest, we don't. There are basically *no* technical reasons to
need firmware linked directly into the kernel. Hell, you can even put
it into an initramfs and do NFS root without needing to do that kind of
thing. We actually agreed at the Kernel Summit in Boston that we could
rip out the legacy images that were being distributed with the kernel
source.

One of the reasons I haven't done that yet — not that I always need a
reason for failing to get round to something — is because it just gets
easier as time goes on. We have an old and incomplete and largely out
of date set of legacy firmware in the firmware/ directory and these
days I think *everyone* is using the separate linux-firmware stuff, so
it should actually be a no-brainer now. Which means I should probably
get on with it at last.

>  it might be legally worthwhile to create and publish a statement 
> from major stakeholders (who are themselves copyright holders as well 
> as technical experts) on the issue.  Lawyers use statements from
> technical experts fairly often.

The interesting one there is not so much firmware as binary modules in
an embedded work. A wireless router is a prime example — where if
*either* the kernel or the binary wifi driver were missing, the work
would have no value. That's one of the poster children for being a
coherent combined work rather than merely aggregation (again, I'm not
claiming truth; only saying that there are those who will argue it).

> I can't think of a better place than a kernel summit (well, maybe
> inside the TAB) where kernel developers could use face-to-face
> communication to determine if there's consensus on this, as a
> first step in creating such a statement.

I don't think we'll ever truly gain consensus. There are those who
choose to interpret it in a permissive way, like James, and there are
others who choose to interpret it in a less permissive way. And have
gone on record as stating that they *are* going to sue a distributor of
combined kernel+module works at some point in the near future.

But even without enough of a consensus to make a coherent statement, it
would still be useful to have an idea of where the distributions of
opinions lies.

And it's also useful to talk about what people *want* it to mean.
You've seen from James's and my discussion that we can decide what we
*want* and then choose to interpret the language to support our
desires.

Are most people happy with binary modules existing at all? Would people
prefer just to switch to a BSD licence for the kernel and stop all the
whining? Are people happy with the embedded products using binary
modules and being *useless* without them? These are all interesting
questions almost regardless of whether we can choose to interpret the
GPL to support our desires. :)

It would be interesting to have a show of hands on those things —
asking both "do you *want* the licence to..." and "do you *believe* the
licence..." in both cases.

> I have no idea if this issue rises to the level of concern that would
> warrant such action.

For firmware, no. But there is a *lot* of FUD around the whole GPL
enforcement issue, even between those who are on *our* side. At times
it seems like we could summon all who purport themselves to be the
"good guys" working on behalf of the people at the Kernel Summit, and
bash their heads together like naughty children.

I'm not actually proposing that we bash heads, but I would like to get
people to sit down in the room and have an adult and factual
discussion.

But yes, absolutely *not* for pontificating and speculation about what
a court would do.

-- 
dwmw2

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5691 bytes --]